Splunk Search

Splunk query- How to use spath command for the below logs?

uagraw01
Motivator

How to use spath command for the below logs i have attached in the screenshot.

IMG_20220512_184747__01__01.jpg

Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I forgot you need to deal with multiline values

| rex "(?ms)Error log: (?<json>\{.*\})"
| spath input=json

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "Error log: (?<json>\{.*\})"
| spath input=json
0 Karma

uagraw01
Motivator

@ITWhisperer Thanks for your reply but it is Not working for me.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What are you getting in the json field?

0 Karma

uagraw01
Motivator

@ITWhisperer I have tried this and now it is working fine.

IMG_20220512_195036__01.jpg

0 Karma

uagraw01
Motivator

@ITWhisperer  I think rex is not properly working.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I forgot you need to deal with multiline values

| rex "(?ms)Error log: (?<json>\{.*\})"
| spath input=json
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...